Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Richard Clayton <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In message <[e-mail]1
4.prod.outlook.com>, Tim Hollebeek <tim.hollebeek=40digicert.com@dmarc.i
etf.org> writes

>    I’m a bit concerned about the discussion of attempting to perform 
>    the checks at any other time, and I’m even more concerned about 
>    what seems to be assertions that it’s ok if the quality of the 
>    checks “degrades over time” as if this were a natural or 
>    unavoidable state.  I think everything possible should be done to 
>    avoid that outcome.

there appears to be an assumption in some of the discussion that
although all sorts of other information might degrade over time (or be
hard for an MUA to establish post hoc) that the image itself is still
magically available for fetching ...

Long ago I asked why the design was not a souped up version of X-Head
where the message and how to display it was entirely self-contained and
all that people who handled the message had to do was to assess whether
or not display was warranted. It does seem that might be somewhat
simpler to document (and implement).

>    Over in LAMPS, we’re spending a lot of time dealing with the 
>    fallout from similar issues being inadequately addressed in the 
>    past with secure email, causing exactly the phenomenon described 
>    here, where over time things just degrade.  It’s very confusing to 
>    end users, and negatively impacts confidence in the entire system 
>    when things change with time, seemingly for no reason.

there is related experience in the PGP world where messages which once
were valid become invalid over time and disappointing the user by
failing to display them does not seem attractive

- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBYtdaw92nQQHFxEViEQLcYgCdFWxvKtT5OE2fG1PRUv65bG0S/HwAn2lC
jdt59DCQmHOpaQf+Ujfc60YQ
=Z7VD
-----END PGP SIGNATURE-----